Enable TPM 2.0 Windows 11: Check tpm.msc and Turn It On

A Trusted Platform Module (TPM) is a small security chip, or a security function built into the processor, that stores encryption keys and checks that the PC has not been tampered with. Windows 11 requires TPM 2.0, and features such as BitLocker, device encryption and Windows Hello rely on it. Many PCs that fail a Windows 11 check actually have a TPM that is simply switched off. This guide shows how to check it and enable TPM 2.0 for Windows 11 using Microsoft’s steps, and what to do when the setting is hard to find.

The steps apply to Windows 11 version 24H2, 25H2 and 26H2, and also to a Windows 10 PC you are preparing to upgrade. Microsoft’s release information page, as checked on 15 October 2026, lists 25H2 and 26H2 as the current Windows 11 versions for Home and Pro.

Step 1: Check the TPM

There are two quick ways.

tpm.msc

1. Press Windows logo key + R, type tpm.msc and select OK.
2. If the status says the TPM is ready for use, look at Specification Version under TPM Manufacturer Information. Microsoft says it should read 2.0.
3. If you see Compatible TPM cannot be found, Microsoft says the TPM may be disabled.

Windows Security

1. Open Windows Security and select Device security.
2. If there is a Security processor section, select Security processor details and check that the specification version is 2.0.
3. If there is no Security processor section, Microsoft says the device probably lacks a TPM or it is not enabled in the firmware.

Result	What it means	Next step
Ready, version 2.0	All good	Nothing to do
Ready, version 1.2	Older TPM	Check for a firmware update; otherwise the PC does not meet Windows 11 requirements
Compatible TPM cannot be found	Probably switched off	Enable it in firmware (below)
Not ready / errors	Needs attention	Install firmware updates; see the troubleshooting section

Step 2: Open the firmware settings

The easiest way in is from Windows:

1. Open Settings > System > Recovery.
2. Next to Advanced startup, select Restart now.
3. Select Troubleshoot > Advanced options > UEFI Firmware Settings > Restart.

If you use BitLocker or device encryption, make sure you can find your recovery key before changing firmware settings; see Windows 11 BitLocker.

Step 3: Find and enable the TPM

Microsoft notes the setting may be in a submenu called Advanced, Security or Trusted Computing, and lists these names:

• Security Device, Security Device Support or TPM State (common on many brands)
• Intel PTT or Intel Platform Trust Technology (Intel processors)
• AMD fTPM switch or AMD PSP fTPM (AMD processors)

Set it to Enabled, then save and exit (often F10). Windows starts as normal. Run tpm.msc again to confirm.

Microsoft recommends checking your PC maker’s support information if you are unfamiliar with firmware settings. Motherboard manuals usually list the exact menu.

What TPM 2.0 does for you

Microsoft’s TPM overview describes the chip as a hardware component that performs cryptographic operations and is designed to be tamper resistant. In everyday terms it:

• Holds the keys that let BitLocker and device encryption unlock the drive automatically when the PC has not been tampered with.
• Protects Windows Hello PIN and biometric credentials so they stay on that device; see Windows 11 PIN and password.
• Supports Secure Boot measurements; see enable Secure Boot.

Troubleshooting

• No TPM option in firmware: update the BIOS/UEFI from the PC or motherboard maker; some older boards add firmware TPM support in an update. Desktops without firmware TPM may have a header for a separate TPM module; check the manual before buying one.
• TPM present but errors in Windows Security: Microsoft’s device security page lists TPM error messages; suggested fixes include updating firmware, enabling the TPM in UEFI or restarting.
• Clearing the TPM: this resets it to its defaults. Microsoft advises backing up data first. Only do it when a troubleshooting step calls for it.
• Version 1.2 only: some business PCs can be switched to 2.0 with a maker’s firmware tool; consumer PCs usually cannot.

TPM questions people often ask

Is my data at risk when I enable the TPM? No. Enabling the TPM in firmware does not touch your files. Clearing an existing TPM is different and can affect BitLocker, which is why the recovery key matters.

Will enabling the TPM turn on encryption? On many PCs, Windows may turn on device encryption once the requirements are met and you sign in with a Microsoft account as an administrator. The recovery key is then saved to that account. Check Settings > Privacy & security > Device encryption afterwards; see Windows 11 BitLocker.

Do I need a separate TPM chip? Most processors from recent years include a firmware TPM (Intel PTT or AMD fTPM), so a separate module is rarely needed. Some desktop motherboards have a header for one, but check the manual before buying; modules are specific to the board.

What about virtual machines? A virtual machine needs a virtual TPM enabled in its own settings to run Windows 11; the host PC’s TPM setting alone is not enough.

When your PC still does not qualify

If the TPM cannot be enabled or is only 1.2, the PC does not meet Microsoft’s Windows 11 requirements. Our upgrade without TPM guide explains the realistic options and the risks of unsupported installs. Windows 10 support ended on 14 October 2025, and Microsoft’s consumer Extended Security Updates run to 12 October 2027 according to its ESU page, as covered in Windows 10 extended security updates end. For the full requirement list, see Windows 11 TPM requirement and the PC Health Check app.